Cinwaan kee ayaa galo DNS-ka server lagu xiriiriyay VPN?
Server la martigeliyay wuxuu hayaa saddex cinwaan oo aan is-beddelmi karin. Dooro qiimaha ay adeeg kastaa u baahan tahay, ka dibna ka xaqiiji meel ka baxsan mishiinka.
Server la martigeliyay oo VPN lagu rakibay wuxuu ugu dambayn hayaa saddex cinwaan, oo midkood oo keliya ayaa ku habboon meel kasta oo aad isku dayayso inaad habayso. Koobista lambarka shirkadda bixisa ee loo gudbinayo DNS, hareeyaha ama liiska oggolaanshaha waa habka tunnel shaqeeya uu u noqdo adeeg aan cidna gaari karin. Hanuunkan wuxuu u habaynayaa shaqada si cinwaan kasta loogu doorto ujeeddo la sheegay. Waxa kale oo uu taxaa amarrada xaqiijinaya waxa aad dhab ahaan daabacday.
Sawir saddexda cinwaan ka hor inta aadan waxba daabicin
U magacow shaqadooda. Cinwaanka underlay waa kan mishiinku isticmaalo si uu u gaaro barta ugu dambeysa ee VPN ee internetka, badanaana waa mid gaar ah oo ka dambeeya NAT-ka bixiyaha. Cinwaanka tunnel-ka wuxuu ku nool yahay gudaha VPN, waxaana bixiya server-ka ama macmiilka iyadoo ku xiran alaabta. Baxa guud waa cinwaanka ay website fog diiwaangeliso ka dib tarjumaadda, oo looma baahna inuu ku jiro interface kasta oo aad weydiin karto.
Guddiga muujinaya hal cinwaan guud oo mishiin waxa uu wax yar ka sheegaa labada kale ee doorarka. Gaaritaanka underlay waa shuruud, ma aha iib: laptop ka dambeeya router guriga ayaa gaari kara barta VPN ee la martigeliyay isagoon haysan cinwaan guud oo IPv4. Waxa aanad samayn karin waa inaad hindiso waddo soo gal ah adigoo qoraya magac u rogmada cinwaan aan cidna gudbin.
Dooro cinwaanka adeegga, ma aha sumadda
Qor waxa server-ku sameeyo ka hor inta aadan dooran lambar. Wicitaannada API ee baxa waxay u baahan yihiin bax joogto ah marka dhinaca kale uu hayo liis oggolaansho. Helitaanka gaarka ah wuxuu u baahan yahay cinwaan tunnel ah oo macmiilladu mari karaan iyo hareeye ku xiran. Martigelinta guud waxay u baahan tahay khariidad soo gal ah oo bixiyuhu dhab ahaan bixiyo, cinwaanka baxana keligiis ma bixiyo taas.
Hal mishiin ayaa u adeegi kara saddexda ujeeddo kuna isticmaali kara saddex cinwaan oo kala duwan. Waxa jabaa waa mala-awaalka ah in hal qiime ay daboosho dhammaantood:
| Requirement | Value that belongs there | What you see when the roles are swapped |
|---|---|---|
| Outbound allowlisting | Public exit | Requests reach the service but are rejected |
| Private client access | Tunnel address | Client connects, nothing answers |
| Inbound web service | Provider mapping | Name resolves, connection times out |
Safka soo galka ayaa ah kan dadku ka doodayaan. Diiwaan ku tilmaamaya cinwaanka baxa ma abuuro hareeye, ma abuuro dalool derbi dab ah, mana abuuro khariidad deked, sugnaashuna ma beddelo taas. Marka bixiyuhu iibiyo cinwaan u gaar ah oo la socda qaanuun soo gal ah, xirmadaasi waa awoodda aad iibsatay; cinwaanka keligiis ma aha xaq.
Amarrada muujinaya cinwaan kee ayaa kee
Akhri mishiinka, ma aha guddiga. Magacyada interface-ka way kala duwan yihiin nidaamyada, sidaas darteed ku xidh cinwaannada qalabka halkii aad ku kalsoonaan lahayd sumad.
Sadarka koowaad wuxuu taxaa cinwaan kasta oo IPv4 iyo qalabkiisa, tan labaadna waxay weydiisaa kernel-ka qalabkee uu isticmaali lahaa goob dibadda ah oo la yaqaan:
ip -brief -4 addr show
ip -4 route get 198.51.100.10
curl -4 -s https://ifconfig.me
ss -lntp | grep -E ':(443|1194)'Haddii raadinta waddo ay ku jawaabto qalab tunnel ah oo loogu talagalay taraafikada guud, tunnellkaaga buuxa wuu shaqeynayaa. Hubinta hareeyaha ayaa si la mid ah muhiim u ah, maxaa yeelay geedi socod ku xiran 127.0.0.1 oo keliya weligiis kama jawaabi doono cinwaanka tunnel-ka, magac kasta oo aad daabacdo.
Daabac, ka dibna dibadda ka xaqiiji
Daabac qiimaha ay adeeggu u baahan yahay oo wax dheeraad ah ma aha: diiwaan A ama AAAA oo loogu talagalay martigelinta, gelitaan liis oggolaansho oo loogu talagalay wicitaannada baxa, profile macmiil oo loogu talagalay helitaan gaar ah. Ka dib tijaabi meesha muhiimka ah, taasina weligeed ma aha mishiinka aad hadda tafatirtay.
Laba hubin ayaa daboolaya inta badan, labaduba way ku filan yihiin in lagu hayo script:
dig +short vpn.example.net A
curl -4 -sS -o /dev/null -w '%{http_code}\n' https://vpn.example.net/healthJawaabta DNS ee caddaynaysa in diiwaankaagu jiro ma aha caddayn in codsi soo gaarayo, codsi guulaystayna wuxuu caddeeyaa oo keliya in hal waddo ka shaqeyso hal shabakad. Ku celi hubinta isku xirka mobilka marka liis oggolaansho ku lug leh, maxaa yeelay baxa aad aragto wuxuu ku xirnaan karaa qoyska cinwaanka iyo waddada la qaaday. Qor qoyskee aad xaqiijisay; waddo IPv4 ah oo shaqeysa waxba kama sheegto IPv6.
Haddii adeeggu yahay mid soo gal ah, cinwaanka baxa kuma filna
Helitaanka soo galka wuxuu u baahan yahay afar shay oo isku toosan: magac ama cinwaan uu macmiilku gaari karo, waddo geysa baakadda mishiinka, hareeye aqbala, iyo siyaasad aan tuurin. VPN waxay beddeshaa qaybta labaad iyo mararka qaarkood tan koowaad, waxbana kama qabato tan saddexaad iyo afaraad. Marka tunnel-ku yahay waddada gaarsiinta, macmiilladu waxay ku xirmaan cinwaanka tunnel-ka, ma aha baxa.
Qor cinwaanka kee ay adeeg kastaa ku tiirsan yahay, ka dib dib u eeg qoraalkaas mar kasta oo bixiyuhu beddelo qaabka waddada. Server si gaar ah u jawaaba oo si guud u guuldareysta badanaa ma jaban; wuxuu ku jawaabaa aqoonsi khaldan, hagaajintuna waa go'aan khariidadayn ma aha isbeddel derbi dab.